> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy templates

> Ready-made policies for every use case. Enable them in one click instead of building rules from scratch.

A policy template is a complete, pre-built policy: a named set of rules tuned for a specific
attack pattern. Instead of authoring conditions yourself, you browse the library, enable the
templates that fit your use case, and they go live. Tracenow ships **22 templates** grouped
across the three threats it protects.

Templates are the fastest way to onboard. You can always edit a template's rules afterward, or
add your own from scratch. See [Rules](/guides/rules) for the manual path.

<Frame caption="Policy template library in the dashboard">
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/tracenow/images/policy-templates-library.png" alt="The policy template library grouped by threat, with enable toggles" />
</Frame>

**📸 Screenshot to add:** the template library under **Guard**, showing the three threat groups and the per-template enable toggles.

## How to enable a template

<Steps>
  <Step title="Connect Cloudflare first">
    Templates evaluate the signals collected by the [Cloudflare integration](/guides/cloudflare).
    Connect and deploy the Worker before enabling them.
  </Step>

  <Step title="Browse the library">
    In the [dashboard](https://tracenow.io/dashboard) under **Guard**, open the template library
    and find the threat you want to cover.
  </Step>

  <Step title="Enable in Monitor mode">
    Turn on the templates you want. Start in **Monitor** so they observe and log without blocking.
    Let real traffic flow for a day or two and review the verdicts in the event feed.
  </Step>

  <Step title="Switch to Enforce">
    Once the verdicts look right for your traffic, flip the templates (or specific rules) to
    **Enforce**. Now `deny` verdicts are enforced at the edge.
  </Step>
</Steps>

<Note>
  Some templates use **device signals** (headless detection, device reuse, timezone mismatch).
  These work automatically once the Cloudflare Worker is deployed, because the Worker injects the
  fingerprint script for you. No extra setup is required.
</Note>

## The library

Each template's name tells you its action: templates named **Block** issue a `deny` verdict,
templates named **Challenge** issue a `challenge`. See [Verdicts](/concepts/verdicts) for how to
handle each.

### Fake accounts

Protects the `signup` event. See the [Fake accounts](/use-cases/fake-accounts) use case.

| Template                                   | Verdict     | Uses device signals |
| ------------------------------------------ | ----------- | ------------------- |
| Block disposable email at signup           | `deny`      | No                  |
| Block infrastructure IPs at signup         | `deny`      | No                  |
| Block signup velocity from same IP         | `deny`      | No                  |
| Block headless browser at signup           | `deny`      | Yes                 |
| Challenge suspicious email signals         | `challenge` | No                  |
| Challenge anonymizing networks at signup   | `challenge` | No                  |
| Challenge same device across many accounts | `challenge` | Yes                 |

### Account takeover

Protects the `login` event. See the [Account takeover](/use-cases/account-takeover) use case.

| Template                               | Verdict     | Uses device signals |
| -------------------------------------- | ----------- | ------------------- |
| Block credential stuffing from same IP | `deny`      | No                  |
| Block brute force on same account      | `deny`      | No                  |
| Block automated login attempts         | `deny`      | Yes                 |
| Block anonymizing networks on login    | `deny`      | No                  |
| Challenge login from new country       | `challenge` | No                  |
| Challenge impossible travel            | `challenge` | No                  |
| Challenge high-risk login signals      | `challenge` | No                  |
| Challenge login from new device        | `challenge` | Yes                 |
| Challenge timezone mismatch on login   | `challenge` | Yes                 |

<Note>
  The new-country, new-device, brute-force, and impossible-travel templates are most accurate
  when they can tie the event to a real account. Add the [server-side call](/guides/server-side)
  with `subject_user_id` to unlock their full fidelity.
</Note>

### SMS pumping

Protects the `otp` event. See the [SMS pumping](/use-cases/sms-pumping) use case.

| Template                                     | Verdict | Uses device signals |
| -------------------------------------------- | ------- | ------------------- |
| Block risky phone numbers from receiving OTP | `deny`  | No                  |
| Block high-risk carrier country on OTP       | `deny`  | No                  |
| Block OTP velocity from same IP              | `deny`  | No                  |
| Block OTP velocity from same user            | `deny`  | No                  |
| Block infrastructure on OTP requests         | `deny`  | No                  |
| Block automated OTP requests                 | `deny`  | Yes                 |

## Templates or custom rules?

|          | Templates                              | Custom rules               |
| -------- | -------------------------------------- | -------------------------- |
| Setup    | One click                              | Build each condition       |
| Best for | Getting protected fast, common attacks | Logic specific to your app |
| Editable | Yes, tune any rule after enabling      | Full control               |

Most teams start with templates in Monitor, then add a custom rule or two for their own edge
cases. See [Rules](/guides/rules) to author your own.

## Next steps

<Columns cols={3}>
  <Card title="Fake accounts" icon="user-xmark" href="/use-cases/fake-accounts">
    Enable the signup templates.
  </Card>

  <Card title="Account takeover" icon="lock" href="/use-cases/account-takeover">
    Enable the login templates, then add the in-app call.
  </Card>

  <Card title="SMS pumping" icon="comment-sms" href="/use-cases/sms-pumping">
    Enable the OTP templates.
  </Card>
</Columns>